Hello, Am Montag, 19. September 2016, 17:17:02 CEST schrieb Per Jessen:

Per Jessen wrote:

...

We have a couple of issues with people saying they can't subscribe and unsubscribe - I've just tried a couple of subscribe/unsubscribe myself, and it does indeed not work. Could someone please have a look asap?

https://progress.opensuse.org/issues/13738 https://progress.opensuse.org/issues/13802 https://progress.opensuse.org/issues/13728

As far as I can tell, nothing was changed in the postfix/mlmmj setup recently, In the logs, I notice lots of messages complaining about permissions, such as:

baloo /usr/bin/mlmmj-bounce[15159]: subscriberfuncs.c:122: Could not opendir(/var/spool/mlmmj/opensuse//subscribers.d/): Permission denied baloo /usr/bin/mlmmj-sub[13087]: subscriberfuncs.c:122: Could not opendir(/var/spool/mlmmj/opensuse-marketing//subscribers.d/): Permission denied

Starting on 8 August, I also see many of these:

baloo /usr/bin/mlmmj-send[16306]: incindexfile.c:56: Error opening index file: Permission denied

Then on 2 September, these begin:

baloo /usr/bin/mlmmj-bounce[9531]: subscriberfuncs.c:122: Could not opendir(/var/spool/mlmmj/opensuse-offtopic//subscribers.d/): Permission denied baloo /usr/bin/mlmmj-unsub[1397]: subscriberfuncs.c:122: Could not opendir(/var/spool/mlmmj/opensuse-security-announce//subscribers.d/): Permission denied

I am in no way well versed in mlmmj, and there is very little info to be found on the net. postfix is running as postfix.postfix, so should be able to read:

drwxr-xr-x 2 nobody root 4096 Sep 2 15:32 /var/spool/mlmmj/opensuse-factory//subscribers.d

However, it can't read the subscriber lists below:

-rw------- 1 nobody root 447 Aug 19 17:48 /var/spool/mlmmj/opensuse-factory//subscribers.d/n

AFAIK there are AppArmor profiles for mlmmj - darix told me about them a while ago. If those profiles are incomplete, they could explain the "permission denied" errors you see. Please check /var/log/audit/audit.log if there are denials, and update the profiles (manually or with aa-logprof) if needed. As a quick solution, temporarily switch the profiles to complain mode. The timestamp of the mlmmj AppArmor profiles (before you change them) might be interesting to find out when (and how?) they were deployed. I wouldn't be too surprised if there is an old version in $configuration_management, and they were accidently (re)deployed... Needless to say: if you need help with AppArmor, just ask ;-) Regards, Christian Boltz -- "make" (here most likely GNU make) and shell opts like each other similar to cats and dogs. [Yamaban in opensuse-packaging] -- To unsubscribe, e-mail: heroes+unsubscribe@opensuse.org To contact the owner, e-mail: heroes+owner@opensuse.org

Per Jessen wrote:

Christian Boltz wrote:

...

AFAIK there are AppArmor profiles for mlmmj - darix told me about them a while ago. If those profiles are incomplete, they could explain the "permission denied" errors you see.

Please check /var/log/audit/audit.log if there are denials, and update the profiles (manually or with aa-logprof) if needed. As a quick solution, temporarily switch the profiles to complain mode.

Ah, yes, I only looked in /var/log/apparmor which is empty. It's been too long since I've fiddled with apparmor.

...

The timestamp of the mlmmj AppArmor profiles (before you change them) might be interesting to find out when (and how?) they were deployed.

Yeah, I'll hold on to the diagnostics.

...

I wouldn't be too surprised if there is an old version in $configuration_management, and they were accidently (re)deployed...

Needless to say: if you need help with AppArmor, just ask ;-)

Thanks, I'll be back.

Quick upate - yes, it's apparmor getting in the way. I'll take a closer look tomorrow. -- Per Jessen, Zürich (14.2°C) http://www.hostsuisse.com/ - virtual servers, made in Switzerland. -- To unsubscribe, e-mail: heroes+unsubscribe@opensuse.org To contact the owner, e-mail: heroes+owner@opensuse.org